dr3z[.]closer[.]website

This domain, dr3z.closer.website, is identified as a credential theft operation specifically impersonating Outlook Web Access, a Microsoft email service. The site is currently offline, but prior analysis confirms its malicious intent to harvest user credentials through brand impersonation techniques. The domain was actively used in phishing campaigns designed to deceive users into entering login credentials on a fraudulent Outlook interface. Analysis of the domain reveals multiple technical indicators of compromise. The domain was flagged by 18 of 95 security vendors on VirusTotal, indicating broad detection of its malicious nature. It was registered through Go Daddy, LLC on February 21, 2026, and resolved to the IP address 94.130.129.186, hosted on AS24940 (Hetzner Online GmbH) in Germany. The SSL certificate was issued by Let's Encrypt (R13), a common tactic to lend superficial legitimacy to phishing sites. The domain appears on one security blocklist and was previously blocked by PhishDestroy. The page title was explicitly set to "Outlook," reinforcing its impersonation of the legitimate Outlook Web Access portal. The current offline status of dr3z.closer.website does not eliminate the risk posed by this infrastructure. Organizations and users should treat this domain as a confirmed threat vector. Immediate actions include blocking the domain and its associated IP (94.130.129.186) at the network perimeter, updating endpoint protection rules to detect and prevent access, and conducting internal reviews for any prior interactions with the domain. Security teams are advised to monitor for similar domains registered through the same registrar or hosted on the same IP range, as threat actors frequently reuse infrastructure. Users who may have entered credentials on this site should reset passwords immediately and enable multi-factor authentication on all accounts.